- Kibana Guide: other versions:
- What is Kibana?
- What’s new in 8.4
- Kibana concepts
- Quick start
- Set up
- Install Kibana
- Configure Kibana
- Alerting and action settings
- APM settings
- Banners settings
- Enterprise Search settings
- Fleet settings
- i18n settings
- Logging settings
- Logs settings
- Metrics settings
- Monitoring settings
- Reporting settings
- Search sessions settings
- Secure settings
- Security settings
- Spaces settings
- Task Manager settings
- Telemetry settings
- URL drilldown settings
- Start and stop Kibana
- Access Kibana
- Securing access to Kibana
- Add data
- Upgrade Kibana
- Configure security
- Configure reporting
- Configure logging
- Configure monitoring
- Command line tools
- Production considerations
- Discover
- Dashboard and visualizations
- Canvas
- Maps
- Build a map to compare metrics by country or region
- Track, visualize, and alert on assets in real time
- Map custom regions with reverse geocoding
- Heat map layer
- Tile layer
- Vector layer
- Plot big data
- Search geographic data
- Configure map settings
- Connect to Elastic Maps Service
- Import geospatial data
- Troubleshoot
- Reporting and sharing
- Machine learning
- Graph
- Alerting
- Observability
- APM
- Security
- Dev Tools
- Fleet
- Osquery
- Stack Monitoring
- Stack Management
- REST API
- Get features API
- Kibana spaces APIs
- Kibana role management APIs
- User session management APIs
- Saved objects APIs
- Data views API
- Index patterns APIs
- Alerting APIs
- Action and connector APIs
- Cases APIs
- Import and export dashboard APIs
- Logstash configuration management APIs
- Machine learning APIs
- Osquery manager API
- Short URLs APIs
- Get Task Manager health
- Upgrade assistant APIs
- Kibana plugins
- Troubleshooting
- Accessibility
- Release notes
- Developer guide
Get live queries API
editGet live queries API
edit[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Get live queries.
Request
editGET <kibana host>:<port>/api/osquery/live_queries
GET <kibana host>:<port>/s/<space_id>/api/osquery/live_queries
Path parameters
edit-
space_id
-
(Optional, string) An identifier for the space. When
space_id
is not provided in the URL, the default space is used.
Query parameters
edit-
page
-
(Optional, integer) The page number to return. The default is
1
. -
perPage
-
(Optional, integer) The number of rules to return per page. The default is
20
. -
sortField
-
(Optional, string) The field that is used to sort the results. Options include
createdAt
orupdatedAt
. The default iscreatedAt
.Even though the JSON case object uses
created_at
andupdated_at
fields, you must usecreatedAt
andupdatedAt
fields in the URL query. -
sortOrder
-
(Optional, string) Specified the sort order. Options include
desc
orasc
. The defaults isdesc
.
Response code
edit-
200
- Indicates a successful call.
Example
editRetrieve the last 10 live queries :
$ curl -X GET api/osquery/live_queries?page=1&perPage=10
The API returns a JSON object of the retrieved live queries:
{ "page": 1, "per_page": 10, "total": 11, "data": [ { "action_id": "3c42c847-eb30-4452-80e0-728584042334", "expiration": "2022-07-26T10:04:32.220Z", "@timestamp": "2022-07-26T09:59:32.220Z", "agents": ["16d7caf5-efd2-4212-9b62-73dafc91fa13"], "user_id": "elastic", "queries": [ { "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0", "id": "6724a474-cbba-41ef-a1aa-66aebf0879e2", "query": "select * from uptime;", "saved_query_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d", "ecs_mapping": { "host.uptime": { "field": "total_seconds" } }, "agents": ["16d7caf5-efd2-4212-9b62-73dafc91fa13"], } ], }, {...} ] }